diff --git a/docs/7-administration/billing/security-products.md b/docs/7-administration/billing/security-products.md
new file mode 100644
index 000000000..bcc5a767f
--- /dev/null
+++ b/docs/7-administration/billing/security-products.md
@@ -0,0 +1,51 @@
+# Email Security and Code Security billing
+
+Email Security and Code Security are generally available. **Subscribing to the
+extension is the purchase**. Subscribe to **Email Security** for mailbox
+protection or **Cloud Security** for Code Security, then configure the mail
+connections or repository scanning policies you want to use.
+
+## Pricing
+
+| Product | Monthly rate | Daily billing |
+|---|---|---|
+| Email Security | **$1 per protected mailbox** | That day's protected-mailbox count × **$1/30** |
+| Code Security | **$0.80 per protected repository**, plus the existing **Cloud Security base fee** | That day's protected-repository count × **$0.80/30** for repository usage |
+
+Usage is billed per day using a **30-day divisor**. Each protected mailbox-day
+or repository-day contributes the daily rate, so changes in coverage affect the
+days on which that coverage is protected.
+
+The existing Cloud Security base fee applies separately from daily repository
+usage charges.
+
+## Free-tier trials
+
+An organization is on the LimaCharlie free tier when its **configured sensor
+quota is 2 or less**. These organizations receive a limited **14-day trial**.
+Organizations with a sensor quota above **2** are on a paid plan and usage is
+billed.
+
+| Product | Trial limits | At expiry | Purge grace period |
+|---|---|---|---|
+| Email Security | **25 protected mailboxes per organization**, across all connections | Collection pauses; configuration is kept | **30 days** |
+| Code Security / Cloud Security | **2 provider connections**, **10 repositories per connection**, **5 container images per organization** for hosted scanning | Collection and hosted scanning pause; provider configuration and policies are kept | **7 days** |
+
+Data is removed after the purge grace period unless the organization moves off
+the free tier before the purge. The grace period starts when the cleanup process
+observes trial expiry; deletion runs asynchronously. Normal data-retention
+policies continue to apply during the grace period. Unsubscribing and
+resubscribing does not restart the trial.
+
+## Moving to a paid plan
+
+Raise the organization's configured sensor quota above **2** to move off the
+free tier. With the extension subscription in place, this lifts the trial
+limits, allows collection or scanning to resume, and starts usage billing.
+Upgrading before the purge cancels deletion scheduled because the trial expired.
+
+See [Email Security getting started](../../email-security/getting-started.md),
+[Email Security trial details](../../email-security/policy.md#plans-the-free-trial-and-the-mailbox-cap),
+and [Code Security getting started](../../cloud-security/code-security/getting-started.md)
+for setup instructions. [Billing options](options.md) explains organization and
+unified billing.
diff --git a/docs/cloud-security/code-security/getting-started.md b/docs/cloud-security/code-security/getting-started.md
index 85c684a0d..22fd136f1 100644
--- a/docs/cloud-security/code-security/getting-started.md
+++ b/docs/cloud-security/code-security/getting-started.md
@@ -13,7 +13,11 @@ nothing until a policy selects repositories.
 
 - The organization is subscribed to Cloud Security (`ext-cloud-security`). Without
   the subscription the Cloud Security pages show an enable screen, and the API
-  answers `403`.
+  answers `403`. **Subscribing is the purchase**: paid usage is **$0.80 per
+  protected repository per month**, billed daily at **$0.80/30 per repository-day**,
+  plus the existing Cloud Security base fee. Free-tier organizations (sensor
+  quota **2 or less**) get a **14-day trial**. See
+  [pricing and trial limits](../../7-administration/billing/security-products.md).
 - You have `cloudsec.get` and `cloudsec.set`. Connecting GitHub with the
   automatic setup below needs a few more permissions, listed in that section.
 - Creating or editing the provider record, including enabling it on that write,
diff --git a/docs/cloud-security/code-security/index.md b/docs/cloud-security/code-security/index.md
index 8e5f69e3c..085a28de5 100644
--- a/docs/cloud-security/code-security/index.md
+++ b/docs/cloud-security/code-security/index.md
@@ -1,5 +1,11 @@
 # Code Security
 
+Code Security is generally available through the **Cloud Security** extension.
+**Subscribing to the extension is the purchase**. Paid Code Security usage costs
+**$0.80 per protected repository per month**, billed daily at **$0.80/30 per
+repository-day** on that day's protected-repository count, plus the existing
+Cloud Security base fee. See [security product billing](../../7-administration/billing/security-products.md).
+
 Code Security scans the source repositories behind your cloud estate and puts
 what it finds into the same risk-ranked worklist as your cloud findings. You
 triage a leaked credential or a vulnerable dependency the same way you triage a
@@ -13,6 +19,20 @@ pull requests that upgrade vulnerable dependencies.
     [Get started](getting-started.md) takes about ten minutes on GitHub: the
     console creates the GitHub App for you and turns scanning on.
 
+## Free-tier trial
+
+Organizations with a configured sensor quota of **2 or less** receive the
+Cloud Security **14-day trial**, with up to **2 provider connections**,
+**10 repositories per connection**, and **5 container images per organization**.
+The repository and image limits apply to hosted scans.
+
+At expiry, collection and hosted scanning pause. Provider configuration and
+policies are kept. Collected data becomes eligible for deletion after a
+**7-day purge grace period**, starting when expiry is observed. Raising the
+sensor quota above **2** moves the organization to a paid plan, lifts the trial
+limits and allows collection and scanning to resume. Upgrading before the purge
+cancels trial-expiry deletion; usage is then billed.
+
 ## What it finds
 
 | Engine | What it looks at | Finding class |
diff --git a/docs/email-security/ai-triage.md b/docs/email-security/ai-triage.md
index b33fe952a..28f89465c 100644
--- a/docs/email-security/ai-triage.md
+++ b/docs/email-security/ai-triage.md
@@ -1,6 +1,6 @@
 # AI Triage
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Email Security produces an explainable verdict for every message. AI triage is the
 optional second pass: an agent that reads a message the way an analyst would, pivots on
diff --git a/docs/email-security/api-reference.md b/docs/email-security/api-reference.md
index 1924d2657..8a0cf16c0 100644
--- a/docs/email-security/api-reference.md
+++ b/docs/email-security/api-reference.md
@@ -1,6 +1,6 @@
 # API Reference
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 All Email Security routes live under
 `https://api.limacharlie.io/v1/mailsec/{oid}/…` and appear in the public OpenAPI
diff --git a/docs/email-security/automation.md b/docs/email-security/automation.md
index 695bb0652..c68d12f40 100644
--- a/docs/email-security/automation.md
+++ b/docs/email-security/automation.md
@@ -1,6 +1,6 @@
 # Events & Automation
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Email Security is not a side-car product with its own event bus. Everything it
 sees becomes ordinary LimaCharlie telemetry, in the same lake as your endpoint,
diff --git a/docs/email-security/campaigns.md b/docs/email-security/campaigns.md
index c31bd29c9..a9e8bdf56 100644
--- a/docs/email-security/campaigns.md
+++ b/docs/email-security/campaigns.md
@@ -1,6 +1,6 @@
 # Campaigns
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 An attack that reached forty mailboxes is one thing that happened, not forty. A
 campaign is the cluster of messages the engine attributed to one attack, so it is
diff --git a/docs/email-security/cli.md b/docs/email-security/cli.md
index 6f521eac1..f24715b9a 100644
--- a/docs/email-security/cli.md
+++ b/docs/email-security/cli.md
@@ -1,6 +1,6 @@
 # Command Line Interface
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 The `limacharlie mailsec` command group covers the Email Security API surface:
 the coverage screen, the message index and drawer, the audited raw-EML download,
diff --git a/docs/email-security/custom-rules.md b/docs/email-security/custom-rules.md
index c248b1ecf..13a7dc338 100644
--- a/docs/email-security/custom-rules.md
+++ b/docs/email-security/custom-rules.md
@@ -1,6 +1,6 @@
 # Mail Rules
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Every mail detection rule lives in your organization's **`dr-mail` Hive**, one rule
 per record. **Email Security → Rules** shows the complete set: search and filter,
diff --git a/docs/email-security/data-residency.md b/docs/email-security/data-residency.md
index 08df3cbd9..f4671e77c 100644
--- a/docs/email-security/data-residency.md
+++ b/docs/email-security/data-residency.md
@@ -1,6 +1,6 @@
 # Data Residency, Encryption and Data Flows
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 This page answers the questions a security or privacy review asks about Email
 Security: where your mail is stored, how it is protected, how long it is kept, and
diff --git a/docs/email-security/detections.md b/docs/email-security/detections.md
index 541b7a1d8..a3a77f1a6 100644
--- a/docs/email-security/detections.md
+++ b/docs/email-security/detections.md
@@ -1,6 +1,6 @@
 # Detections & Verdicts
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Every message gets exactly one verdict, and the verdict always carries its
 reasons. This page explains how the reasons are produced, what the rules can see,
diff --git a/docs/email-security/getting-started.md b/docs/email-security/getting-started.md
index a18558022..51f206b7e 100644
--- a/docs/email-security/getting-started.md
+++ b/docs/email-security/getting-started.md
@@ -1,6 +1,6 @@
 # Getting Started with Email Security
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Connect your organization's Microsoft 365 or Google Workspace mail to analyze
 messages for threats. You do not need to change mail routing or install software
@@ -13,7 +13,7 @@ an analyzed message**. You can configure automated responses later.
 
 ## Before you start
 
-Have these ready before enabling the trial:
+Have these ready before subscribing:
 
 | What you need | Where to get it |
 |---|---|
@@ -30,17 +30,20 @@ A **credential** is the key the product uses to access your mail provider. A
     Free-tier organizations can try Email Security for **14 days**, with up to
     **25 mailboxes**. The clock starts when you subscribe, and resubscribing does
     not restart it. Prepare your administrator access first. At expiry ingestion
-    pauses; data is removed 30 days later unless the organization moves off the
-    free tier. See [trial details](policy.md#plans-the-free-trial-and-the-mailbox-cap).
+    pauses; data is removed after a **30-day purge grace period** unless the
+    organization moves off the free tier before the purge. See
+    [trial details](policy.md#plans-the-free-trial-and-the-mailbox-cap).
 
-    During private beta, limits may be reported before enforcement is enabled.
-    Check the Overview trial/coverage information (or `coverage.entitlement`
-    from the API) for the standing actually in force in your organization.
+    The free tier means a configured sensor quota of **2 or less**. Raising it
+    above **2** moves the organization to a paid plan and lifts the trial limits.
+    See [pricing and billing](../7-administration/billing/security-products.md).
 
 ## 1. Enable Email Security
 
 In your LimaCharlie organization, open **Extensions**, find **Email Security**,
-and subscribe. Then open **Email Security → Settings**.
+and subscribe. **Subscribing is the purchase**: paid usage is **$1 per protected
+mailbox per month**, billed daily at **$1/30 per mailbox-day** on that day's
+protected-mailbox count. Then open **Email Security → Settings**.
 
 If an action is unavailable, ask your organization administrator for access.
 Connection management uses `mailsec_provider.get` and `mailsec_provider.set`;
diff --git a/docs/email-security/groups.md b/docs/email-security/groups.md
index 2e007f23c..608c0cca4 100644
--- a/docs/email-security/groups.md
+++ b/docs/email-security/groups.md
@@ -1,6 +1,6 @@
 # Message Groups & Cases
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A message group represents one email delivered to several recipients, including
 per-recipient personalization. Open
diff --git a/docs/email-security/index.md b/docs/email-security/index.md
index 2907441ae..98aec5625 100644
--- a/docs/email-security/index.md
+++ b/docs/email-security/index.md
@@ -1,6 +1,6 @@
 # Email Security
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 LimaCharlie Email Security protects Microsoft 365 and Google Workspace mailboxes
 from inside the same tenant, permission model, telemetry lake and automation
diff --git a/docs/email-security/internal-domains.md b/docs/email-security/internal-domains.md
index 4b929dd7d..6eb0da3eb 100644
--- a/docs/email-security/internal-domains.md
+++ b/docs/email-security/internal-domains.md
@@ -1,6 +1,6 @@
 # Internal Domains and Message Direction
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Every message Email Security processes gets a `direction`:
 
diff --git a/docs/email-security/ioc-feeds.md b/docs/email-security/ioc-feeds.md
index 9744ea1e9..550d5f8f4 100644
--- a/docs/email-security/ioc-feeds.md
+++ b/docs/email-security/ioc-feeds.md
@@ -1,6 +1,6 @@
 # IOC & Reputation Feeds
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 The managed rule pack carries its own link and sender reputation signals. This
 page is about the other lane: mirroring a threat feed **you** have chosen, and
diff --git a/docs/email-security/mcp.md b/docs/email-security/mcp.md
index f3da7a67a..4fb530ca4 100644
--- a/docs/email-security/mcp.md
+++ b/docs/email-security/mcp.md
@@ -1,6 +1,6 @@
 # MailSec with an AI assistant (MCP)
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 The [LimaCharlie MCP server](https://github.com/refractionPOINT/lc-mcp-server)
 lets an AI assistant review MailSec coverage, messages, campaigns and action
@@ -49,7 +49,7 @@ responses. Profiles select tools; each API still checks its own permissions.
 
 First subscribe to `ext-email-security` through the console, CLI or administration
 profile's `subscribe_to_extension`. Every MailSec endpoint, including onboarding
-instructions, requires the subscription and beta access.
+instructions, requires the extension subscription.
 
 Then use `mailsec_get_onboarding` with `provider: "m365"` or `"gworkspace"` to read
 current setup requirements. Workspace parameters `project_id`, `sa_email`,
diff --git a/docs/email-security/messages.md b/docs/email-security/messages.md
index 04e9b8c27..c24dda282 100644
--- a/docs/email-security/messages.md
+++ b/docs/email-security/messages.md
@@ -1,6 +1,6 @@
 # Messages & Triage
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 **Email Security → Messages** is the shared queue for individual messages and
 [message groups](groups.md). Choose **Messages** or **Groups** with the switch
diff --git a/docs/email-security/pipeline.md b/docs/email-security/pipeline.md
index ed48a8220..59a974531 100644
--- a/docs/email-security/pipeline.md
+++ b/docs/email-security/pipeline.md
@@ -1,6 +1,6 @@
 # How a Message Is Processed
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 This is the page to read first if you are evaluating the product. It follows one
 message from the moment your provider says it exists to the moment somebody
diff --git a/docs/email-security/policy.md b/docs/email-security/policy.md
index b7d0dad8f..322d592e4 100644
--- a/docs/email-security/policy.md
+++ b/docs/email-security/policy.md
@@ -1,6 +1,6 @@
 # Policy Reference
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Email Security is configured through Hive records. Anything the console can
 configure, `limacharlie hive set` can configure — so tenant onboarding and
@@ -517,8 +517,8 @@ Two consequences worth knowing:
 - A changed retention window first receives a report-only sweep. Deletion on
   subsequent sweeps requires the deployment's retention mode to be `enforce`;
   `report` reports candidates without deleting, and `off` disables the sweeper.
-  During private beta, ask the MailSec team to confirm deletion is enabled and
-  check sweep completion. Large backlogs drain over several sweeps.
+  Check sweep completion before treating cleanup as complete. Large backlogs
+  drain over several sweeps.
 - The horizons are independent. A flagged message's evidence can outlive its
   index entry (the usual case: 400 against 35), and if you set `flagged_days`
   *below* `message_days` the reverse happens — the index entry remains without a
@@ -603,7 +603,10 @@ server from your verified claims rather than taken from the request.
 |---|---|---|
 | The organization unsubscribes from Email Security | **30 days** later | Resubscribing at any point inside those 30 days |
 | The organization's free trial ends and it stays on the free tier | **30 days** later | Moving the organization off the free tier at any point inside those 30 days |
-| The organization itself is deleted | Immediately | Nothing — the organization no longer exists |
+| The organization itself is deleted | After a **7-day** grace period | The organization is found to exist again before the purge |
+
+Grace periods start when the cleanup process observes the condition. Deletion
+runs asynchronously after the grace period; normal retention policies still apply.
 
 None of them needs anyone to ask. The 30-day delay exists so that unsubscribing
 by mistake, letting a trial lapse over a holiday, or moving billing around is
@@ -633,14 +636,14 @@ re-sent for the new date.
 
 ## Plans, the free trial, and the mailbox cap
 
-Email Security is in private beta and must be available to your organization
-before you subscribe. For an enabled organization, what differs between a
-**trial** organization and a **paid** one is how long it runs and how many
-mailboxes it protects.
+Email Security is generally available. **Subscribing to the Email Security
+extension is the purchase**. Paid usage costs **$1 per protected mailbox per
+month**, billed daily at **$1/30 per mailbox-day** on that day's protected-mailbox
+count. See [security product billing](../7-administration/billing/security-products.md).
 
-An organization is on the trial when it is on the LimaCharlie free tier — the
-same line the rest of the platform draws, so an organization evaluating Email
-Security and Cloud Security at once gets one answer about what it is paying for.
+An organization gets the trial when it is on the LimaCharlie free tier: its
+configured sensor quota is **2 or less**. Raising the quota above **2** moves the
+organization to a paid plan, lifts the trial limits, and starts usage billing.
 
 | | Trial | Paid |
 |---|---|---|
@@ -648,11 +651,8 @@ Security and Cloud Security at once gets one answer about what it is paying for.
 | Protected mailboxes | **25** | No plan-imposed mailbox cap |
 | Everything else — detections, remediation, retention, API, telemetry | Identical | Identical |
 
-These are the trial terms. During beta, a deployment can report limits before
-enforcing them. Read `coverage.entitlement` for your actual standing and
-enforcement; a reported limit alone does not prove ingestion has paused. Contact
-LimaCharlie to confirm trial or scheduled-deletion enforcement in your data
-region. Policy records and a CLI installation cannot enable server enforcement.
+Read `coverage.entitlement` for the trial countdown, mailbox coverage and any
+scheduled deletion.
 
 ### The 14-day clock
 
@@ -668,27 +668,27 @@ Read the remaining time from the `entitlement` block of
 
 ### What happens when the trial ends
 
-The same thing that happens when an organization unsubscribes, and for the same
-reason — the product stops, nothing is deleted yet:
+If the organization stays on the free tier at expiry, collection pauses and
+configuration is kept:
 
 - **Ingestion pauses.** No new mail is analyzed, and the mail connections are
   not renewed, so the provider's own watches expire on their own schedule.
 - **Nothing is deleted, and nothing is changed.** The connections, the policy
   records and every message already analyzed are intact and follow their normal
   [retention](#data-retention-and-deletion).
-- **Reading and acting still work.** An analyst can still search the queue, read
-  a message and remediate mail that was already ingested.
-- **The 30-day deletion clock starts**, with the notices described above.
+- **A 30-day purge grace period starts when expiry is observed**, with the
+  notices described above. Data is removed after that grace period unless the
+  organization upgrades.
 
-Moving the organization off the free tier resumes ingestion within about five
-minutes, and cancels the scheduled deletion. Mail delivered while ingestion was
-paused is not analyzed retroactively.
+Raising the configured sensor quota above **2** lifts the trial limits, allows
+collection to resume, and cancels trial-expiry deletion if the upgrade happens
+before the purge. Usage is then billed.
 
 ### The 25-mailbox cap
 
 A trial organization protects up to 25 mailboxes. The cap applies to the whole
-organization, across every connected mail tenant, and it works on **activation**
-only:
+organization, across every connected mail tenant, and limits **new mailbox
+protection** only:
 
 - Discovery still finds every mailbox in the tenant — the ones past the cap are
   reported as `discovered` rather than `protected`, so you can see exactly how
diff --git a/docs/email-security/provider-quarantine.md b/docs/email-security/provider-quarantine.md
index 5833b0083..1797d3966 100644
--- a/docs/email-security/provider-quarantine.md
+++ b/docs/email-security/provider-quarantine.md
@@ -1,6 +1,6 @@
 # Microsoft Provider Quarantine
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 **Provider quarantine** shows Microsoft delivery observations and hosted-quarantine
 release activity. Messages blocked before reaching a mailbox may never enter
diff --git a/docs/email-security/provider-setup/google-workspace.md b/docs/email-security/provider-setup/google-workspace.md
index c0417e55a..d879b399c 100644
--- a/docs/email-security/provider-setup/google-workspace.md
+++ b/docs/email-security/provider-setup/google-workspace.md
@@ -1,6 +1,6 @@
 # Google Workspace
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A Google Workspace connection reads and remediates Gmail through the Gmail API,
 using a **service account with domain-wide delegation**. There is no mail
diff --git a/docs/email-security/provider-setup/microsoft-365.md b/docs/email-security/provider-setup/microsoft-365.md
index 65476abec..6b16233b8 100644
--- a/docs/email-security/provider-setup/microsoft-365.md
+++ b/docs/email-security/provider-setup/microsoft-365.md
@@ -1,6 +1,6 @@
 # Microsoft 365
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A Microsoft 365 connection reads and remediates Exchange Online mail over
 Microsoft Graph, using an **application-only** credential. There is no mail
diff --git a/docs/email-security/providers.md b/docs/email-security/providers.md
index 7fc570eec..b3d76a9f7 100644
--- a/docs/email-security/providers.md
+++ b/docs/email-security/providers.md
@@ -1,6 +1,6 @@
 # Connecting Providers
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A mail connection is one `mailsec_provider` Hive record plus one credential in
 the [secret](../7-administration/config-hive/secrets.md) Hive. Two providers are
@@ -180,9 +180,8 @@ and its retained copy follow `flagged_days` (**1–400**, default **400**) separ
 
 Deletion is asynchronous. The deployment must have retention deletion enabled;
 a changed retention window gets a report-only sweep before deletion, and large
-backlogs can take multiple sweeps. During private beta, coordinate with the
-MailSec team to confirm the sweep mode and completion before treating cleanup
-as complete. Restore your intended ongoing retention only after verifying it.
+backlogs can take multiple sweeps. Verify sweep completion before treating
+cleanup as complete. Restore your intended ongoing retention only after verifying it.
 This removes MailSec data, not messages from the provider's mailbox.
 
 Backfilled historical messages are judged but emit no `EMAIL_MESSAGE` or
diff --git a/docs/email-security/remediation.md b/docs/email-security/remediation.md
index 811ee0e47..d8282c777 100644
--- a/docs/email-security/remediation.md
+++ b/docs/email-security/remediation.md
@@ -1,6 +1,6 @@
 # Bulk Remediation
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A campaign sweep acts on a cluster the engine decided. **Bulk remediation** acts
 on a set *you* named — a filtered page of the queue, the result of an LCQL hunt,
diff --git a/docs/email-security/rule-reference.md b/docs/email-security/rule-reference.md
index b16b7cce9..1ed55ac8e 100644
--- a/docs/email-security/rule-reference.md
+++ b/docs/email-security/rule-reference.md
@@ -1,6 +1,6 @@
 # Mail Rule Reference
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Use this reference with [Mail Rules](custom-rules.md). It describes
 `dr-mail` rules and the Message Data Model (MDM) they read. Platform D&R rules on
diff --git a/docs/email-security/sample-submission.md b/docs/email-security/sample-submission.md
index c9d5db28b..b59fbdc37 100644
--- a/docs/email-security/sample-submission.md
+++ b/docs/email-security/sample-submission.md
@@ -1,6 +1,6 @@
 # Sample Submission
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Sample submission lets your analysts send LimaCharlie a copy of a message the
 engine got wrong, so detection can improve. It is **off by default**, it is
diff --git a/docs/email-security/setup-cli.md b/docs/email-security/setup-cli.md
index 8cdcbf01d..dd2070f75 100644
--- a/docs/email-security/setup-cli.md
+++ b/docs/email-security/setup-cli.md
@@ -1,10 +1,10 @@
 # Email Security setup with the CLI
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Prefer the web app? Start with the [console walkthrough](getting-started.md).
 
-Install the beta CLI from `master` as shown above, then [configure authentication](../6-developer-guide/cli-quickstart.md) and select your organization. `$OID` below means your LimaCharlie organization UUID, not its display name. Use `limacharlie org list --output yaml` to find it and set `OID="<organization-uuid>"` for these examples.
+Use a CLI build that includes the commands described above, then [configure authentication](../6-developer-guide/cli-quickstart.md) and select your organization. `$OID` below means your LimaCharlie organization UUID, not its display name. Use `limacharlie org list --output yaml` to find it and set `OID="<organization-uuid>"` for these examples.
 
 This reference takes an organization from zero to a populated Email Security queue:
 enable the product, connect a mail tenant, verify the connection, and read the
@@ -16,7 +16,9 @@ both are shown.
 Email Security is enabled per organization by subscribing to the
 `ext-email-security` extension. The subscription is the enable gate: without it
 every `/v1/mailsec/*` route is refused, and the console shows a subscribe screen
-instead of the product.
+instead of the product. **Subscribing is the purchase**. Paid usage is **$1 per
+protected mailbox per month**, billed daily at **$1/30 per mailbox-day** on that
+day's protected-mailbox count. See [security product billing](../7-administration/billing/security-products.md).
 
 ```bash
 limacharlie extension subscribe --name ext-email-security --oid $OID
@@ -42,16 +44,16 @@ without moving mail. See [Policy Reference](policy.md).
     — start with the executives, finance and the abuse mailbox.
 
     When the trial ends, ingestion pauses and nothing is deleted; the data is
-    removed 30 days later unless the organization moves off the free tier, and
+    removed after a **30-day purge grace period** unless the organization moves
+    off the free tier before the purge, and
     you are told before that happens. The full rules, and the exact fields to
     read the countdown from, are in
     [Plans, the free trial, and the mailbox cap](policy.md#plans-the-free-trial-and-the-mailbox-cap).
 
-    During private beta, trial limits may be reported before enforcement is
-    enabled. Check `mailsec coverage` and its `entitlement` block for your
-    organization's actual standing and enforcement. Contact LimaCharlie if the
-    reported state and collection behavior disagree; saving a connection alone
-    does not establish trial eligibility.
+    The free tier means a configured sensor quota of **2 or less**. Raising it
+    above **2** moves the organization to a paid plan, lifts the trial limits,
+    and starts usage billing. Check `mailsec coverage` and its `entitlement`
+    block for the trial countdown and any scheduled deletion.
 
 ## 2. Grant the permissions
 
diff --git a/docs/email-security/troubleshooting.md b/docs/email-security/troubleshooting.md
index f46b6423f..e1b720001 100644
--- a/docs/email-security/troubleshooting.md
+++ b/docs/email-security/troubleshooting.md
@@ -1,6 +1,6 @@
 # Troubleshooting
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Most Email Security problems are one of a small number of shapes, and the product
 is built so that each of them says so somewhere rather than looking like silence.
diff --git a/docs/email-security/user-reports.md b/docs/email-security/user-reports.md
index daf3c9147..9241b9cd9 100644
--- a/docs/email-security/user-reports.md
+++ b/docs/email-security/user-reports.md
@@ -1,6 +1,6 @@
 # User Reports
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Your own people are the best detector you have for the mail that got through.
 Email Security turns an abuse mailbox into an SLA queue: reports are joined back
diff --git a/docs/includes/code-security-cli.md b/docs/includes/code-security-cli.md
index 1225a5c1c..d66866a5f 100644
--- a/docs/includes/code-security-cli.md
+++ b/docs/includes/code-security-cli.md
@@ -1,11 +1,15 @@
 !!! note "Install the CLI"
-    Install or upgrade the LimaCharlie CLI:
+    CLI examples require a build that includes the `cloudsec code` commands.
+    Check your installation before running them:
 
     ```bash
-    python -m pip install --upgrade limacharlie
     limacharlie cloudsec code --help
     ```
 
+    These commands are not yet in the stable CLI release. Use the web console
+    or REST API, or a development build from the
+    [public SDK repository](https://github.com/refractionPOINT/python-limacharlie).
+
     Installing the CLI does not enable a server capability. Hosted scanning
     and advanced evidence features depend on availability in your organization's
     data region. Check **Code security → Overview**, `code capabilities` and
diff --git a/docs/includes/email-security-availability.md b/docs/includes/email-security-availability.md
new file mode 100644
index 000000000..f6b728a39
--- /dev/null
+++ b/docs/includes/email-security-availability.md
@@ -0,0 +1,19 @@
+!!! info "Generally available"
+    Email Security is generally available. Subscribe to the **Email Security**
+    extension in your organization to purchase and enable it. Paid usage costs
+    **$1 per protected mailbox per month**, billed daily at **$1/30 per
+    mailbox-day**. Free-tier organizations receive a limited **14-day trial**.
+    See [security product billing](/7-administration/billing/security-products/)
+    for pricing, trial limits and upgrading.
+
+    CLI examples require a build that includes the `mailsec` commands. Check
+    your installation before running them:
+
+    ```bash
+    limacharlie mailsec --help
+    ```
+
+    These commands are not yet in the stable CLI release. Use the web console
+    or REST API, or a development build from the
+    [public SDK repository](https://github.com/refractionPOINT/python-limacharlie).
+    Credential-file examples also require `jq`.
diff --git a/docs/includes/email-security-beta.md b/docs/includes/email-security-beta.md
deleted file mode 100644
index 4f77ac20b..000000000
--- a/docs/includes/email-security-beta.md
+++ /dev/null
@@ -1,18 +0,0 @@
-!!! warning "Private beta"
-    Email Security is in **private beta**. It is not generally available, and
-    access is enabled per organization — if the `ext-email-security` extension
-    is not in your catalog, this product is not turned on for you yet.
-
-    While it is in beta, expect the surface described here to move: commands,
-    fields and event shapes may change between releases, and they may change in
-    ways that are not backwards compatible. Install or upgrade the CLI before
-    running the examples:
-
-    ```bash
-    python -m pip install --upgrade limacharlie
-    limacharlie mailsec --help
-    ```
-
-    Credential-file examples also require `jq`. Re-read these pages after upgrading.
-
-    Talk to us before relying on it in production.
diff --git a/mkdocs.yml b/mkdocs.yml
index c491c04b9..a4eb89493 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -521,6 +521,7 @@ nav:
           - SSO: 7-administration/access/sso.md
       - Billing:
           - Options: 7-administration/billing/options.md
+          - Security Products: 7-administration/billing/security-products.md
           - Custom Plans: 7-administration/billing/custom-plans.md
           - Estimating Data Ingestion: 7-administration/billing/data-estimation.md
       - Config Hive:
@@ -591,7 +592,7 @@ nav:
           - Case-Reviewer Agent: 9-ai-sessions/compliance/case-reviewer-agent.md
           - Gap Analysis: 9-ai-sessions/compliance/gap-analysis.md
 
-  - Email Security (Private Beta):
+  - Email Security:
       - Overview: email-security/index.md
       - How a Message Is Processed: email-security/pipeline.md
       - Getting Started: email-security/getting-started.md